01
Detect
Syspeace Service follows the Windows Security event log for repeated failed sign-in attempts and other suspicious authentication activity, then evaluates it against configurable rules.
Product
Host-level protection with remote operational control.
Windows Server exposes sign-in surfaces — Remote Desktop, Exchange, SharePoint, SQL Server, and more — that attackers probe with repeated automated sign-in attempts. Syspeace Service runs on each protected server, watches for that pattern, and blocks the offending addresses. Syspeace Console gives administrators one place to manage every protected server remotely.
Detection, blocking, management, and reporting are separate concerns.
Each stage of the Syspeace workflow does one job well, and each is visible to the administrator on its own terms.
02
Block
Syspeace v4 blocks offending IP addresses directly through the Windows Filtering Platform, so enforcement keeps working even when Windows Firewall is disabled or managed by other software.
03
Manage centrally
Syspeace Console connects to every protected server through the Syspeace relay, so administrators can review and configure services remotely without direct line-of-sight to the server.
04
Report
Access Log and Access Report give administrators a searchable history of sign-in activity, exportable to CSV — plus daily and weekly email reports that summarize what happened without needing to open Console.
Blocking policy that goes further than reacting to your own traffic.
Syspeace isn't limited to blocking what it sees locally — it also draws on shared threat intelligence and lets you set your own blocking rules.
05
Global Blocklist
Blocks reported across the Syspeace customer community are analyzed for repeat offenders and shared back to every Syspeace installation — so an address flagged on someone else's server can be blocked on yours before it ever attacks it.
06
Rules you control
Set your own blocking policy beyond Syspeace's defaults — block an entire country outright with Geo IP override lists, or build detection rules with nested and negative conditions (time of day, IP range, sign-in user, and more) in Syspeace v4.
Administer every protected server from one Console.
- Syspeace Console reaches every paired Syspeace Service through the Syspeace relay, so administrators do not need direct network line-of-sight to the server.
- Multiple administrators can run Console at the same time; configuration changes made in one Console propagate to the others.
- Communication between Console and Service is encrypted, and Syspeace Service can be upgraded remotely from Console.
See what happened, and why a block occurred.
- Current blocks — which IP addresses are presently blocked, and why.
- Access Log — a searchable history of successful and failed sign-in attempts, exportable to CSV.
- Access Report — filter and drill into sign-in activity across a protected server.
- IP activity — the rule that triggered a block, and the individual sign-in attempts behind it.
- Daily and weekly email reports summarizing activity.
What central management looks like.
Built for Windows Server — and Ubuntu Linux.
Syspeace Service protects Windows Server, and in Syspeace v4 it's also available for Ubuntu Linux.
Where Syspeace can help
- Remote Desktop Services (RDP) and Terminal Services sign-ins
- Exchange Server SMTP mail accounts
- File shares and other services using Windows authentication
- Outlook Web Access (OWA)
- Citrix and SharePoint sign-ins
- Microsoft SQL Server sign-in attempts
- Microsoft Routing and Remote Access Service (RRAS) sign-ins
- Website sign-in attempts, using the optional Web Detector
See how this applies to a specific environment on the solutions pages.
Blocking follows rules, not assumptions.
Not every failed sign-in is treated as an attack. Syspeace evaluates activity against configured rules and thresholds before blocking a source — occasional mistyped sign-ins from a legitimate user are a normal, expected part of that pattern, not an automatic block.
Syspeace complements these controls — it doesn't replace them.
- Strong authentication and multi-factor authentication
- Regular patching of Windows Server and hosted applications
- Network segmentation and least-privilege administration
- Account lockout policy
- Endpoint protection and monitoring
- Firewall policy at the network perimeter
Licensed per protected server, per day.
No annual minimum, no rounding up to a fixed plan — choose the servers and dates you need.
See it in your environment
Start a trial, or review what changed in v4.
Install the full Service and Console package on a trial basis, or compare Syspeace v3 and v4 side by side first.